Can I sandbox a binary created in C (with GCC) for Linux and make it easy for users?

Question

I have compiled a binary that I want to distribute to other people.

It's closed-source, but I want to provide users of the binary with confidence that it cannot possibly access the internet, microphone, printer, etc. It also shouldn't be able to read/write files/directories on the filesystem unless they provide that program with access to that file/directory explicitly.

Is this possible in other, more user-friendly ways than telling users to use something like SELinux or AppArmor, where the user has to do something special to run the binary (as opposed to a simple ./program)?

Answer 1

In order to have the confidence in your binary, users will need to use trusted tools to confine it. Any sandboxing tool you bundle with your binary should be considered as (un)trusted as the binary itself.

You could provide a human readable setup script that creates an appropirate chroot or AppArmor configuration. That way, your users will be able to audit the script themsleves and see that your binary is sandboxed properly.

Answer 2

As @Dmitry said, if the application itself is closed source, you need to show the users at least the part that ensures the application is sandboxed, so they can inspect and even change the way of sandboxing (to adapt to their specific security setup). On top of a chroot, the application should also run as its own user (this can be done with setuid on the binary, which is transparent to users), with appropriately restricted access. With regard to sandboxing against various hardware (microphones, network,...), whatever part of this cannot be restricted by user permissions, would require at least lxc or a virtual machine. That makes things more complicated.